Support Azure Read-Only Keys

[sklose]

A service that only wants to serve read-requests currently still needs a key that has read+write permissions, because the CosmosClient on initialization is trying to create the stored procedures in Cosmos that it would need for writes. We should only create those sprocs if the Cosmos client is used from a sink, but not when it's used from a state provider. That would allow services to run with less permissions.